Falhas do tipo CWE-601

1.191 resultados

Redirecionamento aberto (Open Redirect)

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro, query string, etc.) sem validar se o destino é confiável. Um atacante controla para onde a vítima é levada, usando a reputação da aplicação legítima para enganá-la e roubar credenciais ou distribuir malware.

Exemplo

Um site de login tem `redirect.php?url=https://exemplo.com/dashboard`. O atacante muda para `redirect.php?url=https://site-falso.com` e envia o link falso por phishing. A vítima clica confiando no domínio legítimo e acaba em um site fake que coleta suas credenciais.

Como mitigar

Valide e whitelist as URLs permitidas antes de redirecionar — nunca confie no input do usuário. Alternativamente, use IDs ou tokens que mapeiem para destinos pré-aprovados, ou verifique se a URL pertence ao mesmo domínio (validação com regex ou parsing seguro da URL).

CVE-2026-0513MEDIUMOpen Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)EPSS 0.2%CVE-2026-53728HIGHMedplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code LeakageEPSS 0.2%CVE-2025-67585MEDIUMWordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-45055HIGHCubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host HeaderEPSS 0.2%CVE-2025-34439MEDIUMAVideo < 20.1 Open Redirect via cancelUri ParameterEPSS 0.2%CVE-2025-34440MEDIUMAVideo < 20.1 Open Redirect via siteRedirectUri ParameterEPSS 0.2%CVE-2025-12789MEDIUMRhsso: open redirectEPSS 0.2%CVE-2025-55254LOWHCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)EPSS 0.2%CVE-2026-60650HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2026-60646HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2025-26394MEDIUMSolarWinds SWOSH Open Redirection VulnerabilityEPSS 0.2%CVE-2026-20123MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Open Redirect VulnerabilityEPSS 0.2%CVE-2026-61082MEDIUMVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.EPSS 0.2%CVE-2025-60935MEDIUMAn open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crEPSS 0.2%CVE-2025-71244MEDIUMSPIP < 4.4.5 Open Redirect via Login FormEPSS 0.2%CVE-2026-100523MEDIUMCotonti through 1.0.0 Open Redirect via message.php redirect parameterEPSS 0.2%CVE-2026-61097CRITICALVulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). EPSS 0.2%CVE-2024-12924MEDIUMOpen Redirect in Akinsoft's QR MenuEPSS 0.2%CVE-2025-54088MEDIUMOpen Redirect in Secure Access prior to 14.10EPSS 0.2%CVE-2026-25649HIGHTraccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider EndpointsEPSS 0.2%